createMasker

Usage

import { createMasker } from '@pii-mask/core';

const masker = createMasker({
  mode: 'mask',
  disable: ['person-name'],
});

Options

Option	Type	Default	Description
`mode`	`MaskMode`	`'mask'`	Masking mode to use
`disable`	`string[]`	`[]`	Detector IDs to disable
`only`	`string[]`	`undefined`	Run only these detectors
`extend`	`PIIDetector[]`	`[]`	Additional custom detectors
`regions`	`string[]`	`undefined`	ISO 3166-1 alpha-2 codes — filter to detectors matching these regions (universal detectors always included)
`keyNameOnly`	`boolean`	`false`	Only mask fields whose key names them as sensitive; no value patterns at all
`faker`	`Faker`	`undefined`	A `@faker-js/faker` instance — required for `mode: 'substitute'`
`maxDepth`	`number`	`100`	Objects nested deeper than this become `'[Truncated]'`

createMasker throws on an unknown mode, and on mode: 'substitute' without faker. regions accepts UK as an alias for GB.

Return value

The returned masker exposes these methods:

Masking

mask(value, session?) — mask any value and return a masked copy with the same structure
maskString(input, key?, session?) — mask a single string value
maskObject(input, session?) — like mask(), with the result serialized as JSON
maskArray(input, session?) — like mask() for arrays, with the result serialized as JSON

Detection only

detectString(input, key?) — detect PII without masking, returns { detections: string[] }

Restoring

restore(masked, tokenMap) — reverse tokenization (returns string)
restoreValue(value, tokenMap) — restore every string inside a mask() result
restoreObject(masked, tokenMap) — parse a maskObject() result, then restore
restoreArray(masked, tokenMap) — parse a maskArray() result, then restore

Sessions

createSession() — create a MaskSession for cross-call consistency (shared token map and counters)
getTokenMap(session) — the token map (token → original) a session has accumulated

Sessions allow multiple masking calls to share the same token map and pseudonymization counters. Pass the session as the last argument to any masking method:

const session = masker.createSession();
masker.maskString('john@example.com', undefined, session);
masker.maskObject({ email: 'john@example.com' }, session);
// Both calls share the same token/label for the same value

MaskResult

Each masking method returns a MaskResult:

interface MaskResult {
  result: string; // for mask(), the masked value itself
  tokenMap: Record<string, string>;
  detections: string[];
}

Try it in the browser ↗

On this page